Unauthorized Data Modification in miniOrange OTP Verification Plugin for WooCommerce

CVE-2025-14948

What is CVE-2025-14948?

The miniOrange OTP Verification and SMS Notification for WooCommerce plugin for WordPress contains a vulnerability that allows unauthorized data modification. Due to a missing capability check on the enable_wc_sms_notification AJAX action, unauthenticated attackers are able to modify crucial settings, specifically enabling or disabling SMS notifications for WooCommerce orders. This security oversight impacts all versions of the plugin up to and including 4.3.8, posing a significant risk to the integrity of order notifications and overall e-commerce operations.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References